CN111258666A

CN111258666A - Reading method and device of computer file, computer system and storage medium

Info

Publication number: CN111258666A
Application number: CN202010075338.9A
Authority: CN
Inventors: 汤伟; 黄玉兔
Original assignee: Qianxin Technology Group Co Ltd; Secworld Information Technology Beijing Co Ltd
Current assignee: Qianxin Technology Group Co Ltd; Secworld Information Technology Beijing Co Ltd
Priority date: 2020-01-22
Filing date: 2020-01-22
Publication date: 2020-06-09
Anticipated expiration: 2040-01-22
Also published as: CN111258666B

Abstract

The invention provides a method and a device for reading a computer file, a computer system and a storage medium, wherein the method for reading the computer file comprises the following steps: manufacturing a GPT partition starting file of the windows system, wherein the GPT partition starting file is used for guiding the starting of a GPT partition in the Linux system; providing a storage file; starting a windows system according to the GPT partition starting file in the FAT32 starting partition, starting a Linux system according to the configuration information in the started configuration file, and reading the storage file in the Linux system. The method starts the system by using a GPT partition starting mode of the Windows system, and then gives the system starting control right to the Linux system after the system is started, so that the Linux system is started under the GPT partition, and the storage file under the Linux system is read.

Description

Reading method and device of computer file, computer system and storage medium

Technical Field

The present invention relates to the field of information security technologies, and in particular, to a method and an apparatus for reading a computer file, a computer system, and a storage medium.

Background

In the technical field of computers, reading of files is often involved, particularly in a virtual machine during computer forensics, wherein real simulation of a Linux system is also an important link in the forensics field, and random wide use of GPT partitions has important meaning for real simulation of case materials in the part. However, due to the fact that the startup support of the Linux system is not perfect under the GPT partition, the situation that the Linux system cannot be started successfully occurs during simulation, and the development of work is affected. Therefore, it is necessary to provide a method for normal startup of the Linux system in the GPT partition on the virtual machine.

Disclosure of Invention

The invention aims to provide a method and a device for reading a computer file, a computer system and a storage medium, and provides a method for starting a Linux system in a GPT partition.

In order to achieve the above object, the present invention provides a method for reading a computer file, comprising the steps of:

generating a GPT partition starting file of the windows system, wherein the GPT partition starting file is used for guiding the starting of a GPT partition in the Linux system;

acquiring a storage file, making a mirror image file of the storage file, and carrying out snapshot processing on the mirror image file to form a snapshot file;

starting a windows system according to the GPT partition starting file in the FAT32 starting partition, starting a Linux system according to the configuration information in the started configuration file, and reading the image file in the Linux system.

Further, the GPT partition boot file includes an operating system module, a file system module, and a partition boot module.

Further, the storage file is a mirror image file, and the mirror image file is subjected to snapshot processing to form a snapshot file.

Further, when snapshot processing is performed, the image file is processed by adopting a snapshot technology under a virtual machine framework to form a snapshot file.

Furthermore, when the GPT partition starting file is manufactured, the GPT partition starting file is generated through a grub-mkimage.

Furthermore, when the Linux system is started, the main program installed in the starting area is executed first, and then the configuration file and the environment parameter file are loaded.

Furthermore, the reading method of the computer file is used for computer forensics.

In order to achieve the above object, the present invention provides a computer file reading apparatus, including a partition forming module, a storage file, and a starting module, where the partition forming module is configured to make a GPT partition starting file of a windows system, the GPT partition starting file is configured to guide starting of a GPT partition in a Linux system, the storage file is configured to make a mirror image file, and perform snapshot processing on the mirror image file to form a snapshot file, and the starting module is configured to start the windows system in a FAT32 starting partition according to the GPT partition starting file, then start the Linux system according to configuration information in the started configuration file, and read the storage file in the Linux system.

In order to achieve the above object, the present invention further provides a computer system comprising a plurality of computer devices, each computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processors of the plurality of computer devices collectively implementing the steps of the aforementioned method when executing the computer program.

In order to achieve the above object, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which when executed by a processor implements the steps of the aforementioned method.

By adopting the technical scheme, compared with the prior art, the invention has the following beneficial effects:

the method, the device, the computer system and the storage medium for reading the computer files provided by the invention start the system by utilizing a GPT partition starting mode of a Windows system, and then transfer the system starting control right to a Linux system after the system is started, so that the Linux system is started under the GPT partition, and the storage files are made into mirror image files to form snapshot files, thereby realizing the reading of the storage files under the Linux system.

Drawings

FIG. 1 is a flow chart of a method for reading a computer file according to the present invention;

FIG. 2 is a directory structure diagram constructed during startup according to the method for reading computer files of the present invention;

FIG. 3 is a block diagram of a reading apparatus for computer files according to the present invention;

fig. 4 is a hardware architecture diagram of one embodiment of the computer apparatus of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

Example one

As shown in fig. 1, in step S10, first, a GPT (globally unique partition table) partition boot file of the windows system, such as a bootx64.efi file, may be generated in the computer system, so that other valid efi files can be loaded and booted by the computer, where the GPT partition boot file is used to boot the GPT partition under the Linux system in addition to the boot of the GPT partition of the windows system, and the GPT partition boot file may integrate many module characteristics, including: an operating system module, a file system module, a partition starting module and the like.

The GPT partition is a standard of the structural layout of a partition table of a physical hard disk, is a part of extensible firmware interface (UEFI) standard, is used for replacing a Master Boot Record (MBR) partition table which uses 32bits to store logical block addresses and partition size information in a BIOS system, and uses 64bits to record the logical block addresses, so that a larger hard disk space can be supported. The GPT partition format contains a traditional MBR (master boot record), a partition table header, a partition table, a backup partition table header, a backup partition table, and a data area. For compatibility and security, the GPT partition format retains a conventional MBR at LBA0 (first logical sector) to prevent hard disk management software that does not support GPT from misidentifying and corrupting hard disk data, and in this MBR there is only one partition marked with 0xEE to indicate that this hard disk uses the GPT partition format. Software which does not support the GPT partition format can identify partitions of unknown types; and the software supporting the GPT partition format can correctly identify the GPT partition disk.

GPT partitioning is a disk partitioning architecture used by the Extensible Firmware Interface (EFI) and has many advantages over the Master Boot Record (MBR) partitioning method in that it allows up to 128 partitions per disk, supports volume sizes up to 18 gigabytes, allows both the primary and backup disk partition tables to be used for redundancy, and supports unique disk and partition ids (guids). In contrast to the Master Boot Record (MBR) disk partition style, which supports a maximum volume of 2tb (bytes) and a maximum of 4 main partitions per disk (or 3 main partitions, 1 extended partition and unrestricted logical drive), the GUID Partition Table (GPT) disk partition style supports a maximum volume of 18eb (bytes) and a maximum of 128 partitions per disk. Unlike MBR partitioned disks, the vital platform operation data is located in partitions, not in non-partitioned or hidden sectors. In addition, GPT partition disks have redundant primary and backup partition tables to improve the integrity of the partition data structure. On the "volume" tab in the disk attribute dialog in "disk management", the disk with the GPT partition style is displayed as a GUID Partition Table (GPT) disk, and the disk with the MBR partition style is displayed as a Master Boot Record (MBR) disk.

The EFI can be a miniaturized system constructed by a modularized high-level language (mainly C language), the EFI is upgraded after 2.0 edition and is called UEFI, the EFI is the same as the BIOS and mainly completes hardware initialization in the starting process, but the EFI directly identifies system hardware and completes hardware initialization by using a mode of loading EFI drive, and various interrupt execution is abandoned completely. The EFI driver is not directly code facing the CPU, but is coded and written by EFI byte codes, the EFI byte codes are special virtual machine instructions for the EFI, and the operation needs to be explained in an EFI driver operating environment DXE, so that the EFI can realize wildcard and provides good compatibility. In addition, the EFI is 32bits or 64bits completely, 16-bit real mode is abandoned, and the maximum addressing of the processor can be realized in the EFI, so that any information can be stored in any memory address. In addition, because the drive development of the EFI is very simple, the EFI can contact all hardware functions in principle based on the drive model of the EFI, and file reading and writing and network browsing are completely possible on the EFI. The CMOS setup program on the BIOS is executed on EFI as an EFI program, the hardware setup is a hardware setup program, the boot management is another program, and the saving CMOS is yet another program, although they are together on the form Shell.

Whether EFI or UEFI, necessary parts such as a preloading environment, a drive execution environment, a driver and the like are required to be formed, and in order to support part of old equipment (such as a traditional MBR hard disk mounted under UEFI, a display card which does not support UEFI startup still supports operation under UEFI and the like), a CSM compatibility support module, EFI or UEFI are required to support only a GPT disk boot system.

EFI is functionally equivalent to a light-weight OS, but EFI is positioned at the time of manufacture to a position insufficient to become a professional OS, and first, it is only an interface between hardware and an operating system; secondly, EFI does not provide an interrupt access mechanism, EFI must check and interpret hardware in a polling manner, which is less efficient than the execution efficiency of the driver under OS, and finally EFI has a simple memory management mechanism, and only segments the memory in the segment protection mode, and all programs can access any segment position without providing real protection service. Along with the EFI, a brand-new GUID disk partition system (GPT) is introduced and supported, a traditional MBR disk only has 4 main partitions, only when the number of the main partitions is less than 4, an extended partition can be established, then a logical partition identified by the system is established, the number of the logical partitions is large, too many logical partitions can seriously influence the system startup, the MBR hard disk partition only supports 2T capacity to the maximum extent, and the traditional high-capacity hard disk is wasted. GPT supports any number of partitions, each partition size being unlimited in principle, but in practice cannot be unlimited due to OS specification limits, but is a very important advance over the 2T limit of MBRs. The partition type of the GPT is uniquely specified by the GUID table, duplication is substantially impossible, and the EFI system partition can be accessed by EFI to access partial drivers and applications, and although this in principle makes the EFI system partition unsafe, some 'edge' data is generally placed here, which generally has no serious consequences even if it is damaged, and can be simply restored back.

The GPT partition launch file may be formed by a generation tool, such as a grub-mkimage. exe program, in a command line manner, with a command format as follows:

grub-mkimage-o bootx64.efi-p/efi/boot-O x86_64-efi fat iso9660 part_gpt part_msdos normal boot linux linux16 configfile loopback chain efifwsetupefi_gop efi_uga ls search search_label search_fs_uuid search_fs_file exfatext2 ntfs btrfs hfsplus udf

the bootx64.efi file can be generated by adopting the above commands and is used for system startup.

The structure of the file core.img which can be used for generating by the grub-mkimage program is firstly the diskboot.img, then the decompressor lzma _ decompression.img, then the kernel.img, and finally the image corresponding to each module. The files are loaded after the computer is started, the boot.img of the first sector is read, a starting sector of the whole core.img is stored in a certain position of the file, then a sector, such as the diskboot.img, is read from the starting sector, the length of a subsequent image is stored at the tail end of the image, the data is read according to the length, a header of the data, such as the lzma _ decompression.img image, stores compressed parameters, such as the size of a compressed file and the size of the decompressed file, the subsequent data is decompressed according to the parameters to obtain the image starting addresses of the kernel.img and each module, and finally the entry function of the kernel.img is entered for continuous execution.

UEFI can be started in a mode of/EFI/Boot/bootx64. EFI, then the process is handed to a program EFI by the UEFI, the program can be generated by using a grub-mkimage command, a built-in configuration file is needed in the program EFI, a grudr file similar to grub needs a configuration file similar to menu.lst, and an externally-directed cfg configuration file in the designated configuration file.

The GPT partition mode is stronger and more stable than the MBR partition mode, and if it needs to know in advance whether the partition of the hard disk is the GPT mode or the MBR mode, the fdisk command (sudo fdisk-l) or the parked command (sudo parked-l) can be executed in the terminal operation under the Linux system environment, and the partition mode can be seen in the disk label.

In this embodiment, because dual systems need to be run, the boot file needs to integrate many module characteristics, the GPT partition boot file includes an operating system module, a file system module, and a partition boot module, and can be formed by corresponding program tools, the operating system module uses event triggers, all objects capable of triggering events are instances of eventemiter class, and these objects have an eventemiter.on () function for binding one or more functions to named events; the file system module is an operation module of files and folders and mainly operates two parts, one is a folder and the other is a file; the partition starting module can load the hardware information of the BIOS and carry out self-checking, and can read and execute the guiding partition in the first starting device according to the setting.

In step S20, a storage file is obtained in the computer system, an image file of the storage file is made, the image file is snapshot processed to form a snapshot file, the storage file is obtained by copying, downloading, generating through software, and the like, the storage file includes a picture, an audio file, a video file, an application file, a document, and the like, and is also used as an object to be verified, the storage file may be in any file format, and records corresponding data, in order to ensure the integrity of the verified image file, the original verified image file is snapshot processed at the initial stage of simulation, so that the modified content is recorded in the snapshot file, which may be stored on a disk, and a snapshot technology under a virtual machine (VMware) framework may be adopted to snapshot the image file to form the snapshot file, the system of the snapshot file is a GPT partition, the starting partition adopts FAT32 format, FAT32 format compatibility is good, almost all operating systems can be handled, reading and writing work can be carried out quickly, and safety permission does not need to be set.

In order to perform simulation electronic evidence collection, data acquisition is usually realized by mirroring (image), and a mirror image file is an effective way of protecting and extracting evidence, and is an important link of data evidence collection, that is, a storage file is a mirror image file. The mirror image file is obtained by copying the original data bit by bit to generate mirror image data which is completely consistent with the original data and can be used for evidence of analysis in a simulation environment. The format of the image file can be divided into an original format and a proprietary format, wherein the original format refers to a format which is copied according to the original bits of the disk without compression, such as a DD format; proprietary formats are image formats owned by professional imaging tools, including E01, Ex01, X-WaysForensecs CTR, and so on. Creating an image file and selecting a source disk needing to be imaged; then selecting a mirror image format, and inputting relevant information after a path is formed everywhere; and after the mirror image is finished, automatically checking the generated mirror image, wherein the check is to verify whether the hash value generated by the new mirror image is the same as the file hash value of the source disk, and when the check values are the same, the generated mirror image file can be proved to be the same as the source file.

The purpose of the snapshot technology includes that data information at a certain moment can be recorded and saved, and if certain faults occur later and data recovery is needed, the data can be recovered to the state of the previous time point through a snapshot file, and the data after the time point are lost. The purpose of the snapshot technique is to enable recovery before a system error occurs, while the purpose of the mirroring technique is to ensure data redundancy and to recover quickly when a data source fails. If the user deletes a certain file by mistake, the user can reply if the user takes a snapshot before; if the user does the mirror image, the file under the mirror image file is lost and cannot be recovered. Conversely, if the user's target data source is corrupted and all data is lost, the snapshot can only be restored to the most recent snapshot. The latest modified data can be lost, and the mirror image can quickly recover all the data, thereby ensuring the continuity of the service. The snapshot file formed by the rapid processing of the image file confirms that the data can be securely processed.

As shown in fig. 2, a directory structure at startup is constructed, where EFI, BOOT, and centros correspond to corresponding file names, bootx64.EFI is a windows system BOOT file, grubx64.EFI is a Linux system BOOT file, grub1.cfg and grub1.cfg are configuration files, a windows system GPT partition startup manner can be constructed in a FAT32 partition, a windows system GPT BOOT file a is added in a directory of the BOOT file, in step S30, a Linux system can be started in a FAT32 BOOT partition in the computer system according to the GPT partition BOOT file, that is, the windows system (booted 64.EFI file) is started first when a virtual machine is started, then the Linux system is started according to configuration information of the started configuration file, the configuration information points to the Linux BOOT file, that is started according to configuration information in the configuration file after startup, and the BOOT information of the BOOT partition is used for the gpot/ground partition EFI. cfg of the Linux system is configured for GPT partition/gpu 25. cft partition, the detection of a valid operating system kernel can be automatically attempted, and a corresponding operating system menu item can be generated, and the content of specific configuration information can refer to the following:

set timeout＝3

hiddenmenu

menuentry'CentOS'{

chainloader/efi/centos/grubx64.efi

}

after the above operations are executed, the operation is simulated and enters a Linux system, so that the operation can be used for computer forensics, and at the moment, the operation can be configured, and forensics can be finished in a storage file of an image.

In the process of starting the Linux system, after the information is read in advance, the boot loader is read by the MBR of the first starting device, the boot loader can have the functions of menu, direct loading of core files, control transfer and the like, and the system has to have a loader to load the core of the operating system. The Linux system divides the program code execution and the configuration value loading of the boot loader into two stages (stages) for execution, wherein the first stage is to execute a main program of the boot loader, the main program must be installed in a boot area, namely, the main program installed in the boot area, namely, the MBR or the boot sector, is usually installed only in the minimum main program of the boot loader, and does not install a related configuration file of the boot loader; the second phase is to load all configuration files and related environment parameter files (including file system definitions and main configuration files grub. cfg) through the boot loader, generally below/boot.

For a system partition, which is a partition, such as a GPT partition, that directs hardware-specific files needed to load a Windows system (or Linux system), such as ntdrr, boot.ini, ntdetect.com, the system partition may (but need not) be the same as the boot partition. The boot partition refers to a partition containing an operating system and its supporting files, such as a FAT32 partition. That is, the system partition is a partition for storing various boot files (also called boot partition), and the boot partition is a partition for storing a Windows system directory (or Linux system directory). For example, in a Windows 7 system, the partition storing the bootgr file and the boot directory is a system partition, and the boot partition is a partition storing the Windows directory. For a general system user, the system partition is generally the boot partition, because the boot file and the Windows directory are both in the same location, in this scheme, the system partition and the boot partition may not be in the same location. Java version, installation directory, operating system, etc. information may be obtained through the system class in Java.

Example two

As shown in fig. 3, a reading apparatus 10 for a computer file according to this embodiment is shown, which is capable of operating in a computer system and a corresponding machine device thereof, and includes a partition forming module 11, a storage file 12, and a starting module 13, where the partition forming module 11 is configured to make a GPT partition starting file of a windows system, the GPT partition starting file is used to guide starting of a GPT partition under a Linux system, the storage file 12 is used to make an image file, and snapshot processing is performed on the image file to form a snapshot file, the starting module 13 is configured to start the windows system according to the GPT partition starting file in a starting partition of a FAT32, start the Linux system according to configuration information in the started configuration file, and read the storage file in the Linux system.

In the partition forming module 11, that is, when the GPT partition starting file is created, the GPT partition starting file may be generated by a grub-mkimage.exe program, an operating system may be booted in two ways, namely direct-load and chain-load, the operating system written in the default configuration file is booted directly by the default boot loader, the chain-load uses the default boot loader to boot another boot loader in a chain manner, and the other boot loader will boot the corresponding operating system.

In this implementation, the snapshot module may be further included, where the snapshot module is configured to form the storage file 12 into a snapshot file, and a snapshot technology adopted by the snapshot module may include three major categories, namely, a split mirror (split mirror), a change block (changedblock), and a concurrent (current), and the latter two technologies generally use a pointer remapping (pointer remapping) technology and a copy on write (copy on write) technology during implementation, and the flexibility of the changed block mode and the efficiency of using a storage space. The reading device of the computer file can create a snapshot file for the mirror image file with the APFS file system under the VMware Workstation Pro framework, namely, the snapshot file is formed by carrying out snapshot processing on the mirror image file.

The image separation constructs the data image before the instant copy, and when a complete image for copying appears, the instant copy can be generated by instantly separating the image. Changing a block is that after a snapshot is successfully created, the source and target share the same copy of physical data until a write operation occurs to the data, at which point the source or target will be written to new storage space, the shared data units may be blocks, sectors, or other levels of granularity, and in order to record and track changes and copy information of the blocks, a bitmap (bitmap) is needed that determines where the data is actually copied and whether the data is to be retrieved from the source or the target. Concurrency is very similar to changing blocks, but it always physically copies data, and when copy-on-demand is performed, no data is copied, it creates a bitmap to record the copying of data, and does the true physical copying of data in the background.

In this embodiment, the storage file 12 may be in any file format, and records corresponding data, and the storage file 12 includes a picture, an audio file, a video file, or a document, and is also an object to be forensics, and is usually made into an image file, and snapshot processing is performed, and a snapshot file is created under a VMware framework, so that modified content may be recorded in the formed snapshot file. And after the Linux system is started, the evidence obtaining work can be finished by simulating.

Because dual systems need to be operated, the GPT partition starting file comprises an operating system module, a file system module and a partition starting module, the operating system module adopts an event trigger, all objects capable of triggering events are instances of eventemiter class, and the objects have an eventemiter.on () function which is used for binding one or more functions to named events; the file system module is an operation module of files and folders and mainly operates two parts, one is a folder and the other is a file; the partition starting module can load the hardware information of the BIOS and carry out self-checking, and can read and execute the guiding partition in the first starting device according to the setting.

The above-described embodiments of the apparatus are merely illustrative, and the units described as separate parts may or may not be physically separate, and the parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on at least two network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of the embodiments of the present application. One of ordinary skill in the art can understand and implement it without inventive effort.

EXAMPLE III

As shown in fig. 4, the computer system further includes a plurality of computer devices 20, in the second embodiment, components of the multithread calling apparatus may be distributed in different computer devices 20, and the computer devices 20 may be smartphones, tablet computers, notebook computers, desktop computers, rack servers, blade servers, tower servers, or rack servers (including independent servers or a server cluster formed by a plurality of servers) that execute programs, and the like. The computer device 20 of the present embodiment includes at least, but is not limited to: a memory 21, a processor 22 communicatively connected to each other by a system bus. It is noted that fig. 4 only shows the computer device 20 with components 21-22, but it is to be understood that not all shown components are required to be implemented, and that more or fewer components may be implemented instead. In this embodiment, the computer system refers to a hardware part of the relevant computer device which becomes a whole set of system, and in other embodiments, the computer system refers to a software part corresponding to an operating system of the computer.

In the present embodiment, the memory 21 (i.e., a readable storage medium) includes a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory, etc.), a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, and the like. In some embodiments, the storage 21 may be an internal storage unit of the computer device 100, such as a hard disk or a memory of the computer device 20. In other embodiments, the memory 21 may also be an external storage device of the computer device 20, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), or the like, provided on the computer device 20. Of course, the memory 21 may also include both internal and external storage devices of the computer device 20. In this embodiment, the memory 21 is generally used for storing an operating system and various application software installed in the computer system device, such as a reading device of a computer file in the second embodiment. Further, the memory 21 may also be used to temporarily store various types of data that have been output or are to be output.

Processor 22 may be a Central Processing Unit (CPU), controller, microcontroller, microprocessor, or other data Processing chip in some embodiments. The processor 22 is typically used to control the overall operation of the computer device 20. In this embodiment, the processor 22 is configured to execute the program code stored in the memory 21 or process data. The method for reading a computer file according to the first embodiment is implemented when the processors 22 of the plurality of computer devices 20 of the computer system of the present embodiment collectively execute the computer program.

Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented by software plus a general hardware platform, and certainly can also be implemented by hardware. It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware related to instructions of a computer program, which can be stored in a computer readable storage medium, and when executed, can include the processes of the embodiments of the methods described above.

Example four

The present embodiment also provides a computer-readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory, etc.), a Random Access Memory (RAM), a Static Random Access Memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, a server, an App application mall, etc., on which a computer program is stored, which when executed by a processor implements corresponding functions. The computer-readable storage medium of this embodiment stores the reading apparatus 10 of the computer file of the second embodiment, and when executed by a processor, implements the reading method of the computer file of the first embodiment.

At present, due to the fact that a virtual machine (VMware) can not well support the Linux starting of a GPT partition, when the Linux is simulated, the Linux cannot enter a system, and simulation failure can be caused. By adopting the embodiment, the starting mode of the windows system GPT partition is utilized, after the system is started, the started control right is given to the Linux system GPT partition control program, and the start is finally completed, so that the Linux system of the GPT partition is smoothly started without any processing, and the content of the storage file can be read under the environment of the Linux system.

Through the above description of the embodiments, those skilled in the art will clearly understand that the method of the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but in many cases, the former is a better implementation manner.

The above description is only a preferred embodiment of the present invention, and not intended to limit the scope of the present invention, and all modifications of equivalent structures and equivalent processes, which are made by using the contents of the present specification and the accompanying drawings, or directly or indirectly applied to other related technical fields, are included in the scope of the present invention.

Claims

1. A method for reading a computer file, comprising the steps of:

2. A method for reading computer files according to claim 1 wherein said GPT partition boot file comprises an operating system module, a file system module and a partition boot module.

3. A method for reading a computer file according to claim 1 or 2, wherein the storage file includes a picture, an audio file, a video file, an application file, and a document.

4. The method according to claim 3, wherein when the snapshot processing is performed, the snapshot technology under the virtual machine architecture is used to process the image file to form the snapshot file.

5. The method for reading a computer file according to claim 1 or 2, wherein the GPT partition activation file is generated by a grub-mkimage.

6. The method for reading computer files according to claim 1 or 2, wherein when the Linux system is started, the main program installed in the boot area is executed first, and then the configuration file and the environment parameter file are loaded.

7. A method for reading a computer file according to claim 1 or 2, wherein the method is used for computer forensics.

8. An apparatus for reading a computer file, comprising:

the system comprises a partition forming module, a partition starting module and a partition updating module, wherein the partition forming module is used for manufacturing a GPT partition starting file of the windows system, and the GPT partition starting file is used for guiding the starting of a GPT partition in the Linux system;

the storage file is used for making a mirror image file and carrying out snapshot processing on the mirror image file to form a snapshot file;

and the starting module is used for starting the windows system in the FAT32 starting partition according to the GPT partition starting file, starting the Linux system according to the configuration information in the started configuration file, and reading the storage file in the Linux system.

9. A computer system comprising a plurality of computer devices, each computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processors of the plurality of computer devices collectively implement the steps of the method of any one of claims 1 to 7 when the computer program is executed.

10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method according to any one of claims 1 to 7.